Delta Dental Hit with $2M Fine Over Inconsistent Data Retention Policies New York state regulators fined Delta Dental Insurance Company over $2 million for failing to enforce its own data retention policies, exposing critical gaps in compliance and incident response. The case stemmed from a data breach where regulators discovered that the company’s strict retention rules intended to delete certain records after one year were inconsistently applied. Despite corporate policies mandating deletion, Delta Dental’s software allowed employees to override retention settings on a file-by-file basis, with no formal approval process. Investigators found emails older than five years still in the system, contradicting the company’s claims that such records had been purged. The lack of documented procedures for retention exemptions further compounded the issue, leaving the company vulnerable to legal and regulatory scrutiny. The breach highlighted broader risks: even well-drafted policies are ineffective if not uniformly enforced. Regulators, including the FTC and state agencies, are increasingly targeting companies that fail to align actions with public promises whether in data retention, incident response, or breach notifications. The case serves as a warning that IT and compliance teams may face direct accountability when policies are selectively applied or poorly documented.